Where the investigation started
This case began with an email-related allegation in a corporate setting. My job was not to accept the first explanation as the answer. I needed to understand what the technical evidence actually showed while keeping identifying client details out of the case study.
The investigation centred on the email itself and the associated attachments. Before asking whether something was malicious, I first needed to establish what had been sent, where it appeared to come from, how it travelled, and what evidence could be preserved.
Preserving the evidence
I treated the email and its associated files as evidence rather than ordinary working files. The priority was to avoid unnecessary modification, preserve the original material, document what I was examining and maintain integrity through the examination process.
Hash verification was part of that discipline: it gave me a way to identify the files consistently and support integrity checks as the attachments moved through later analysis.
Understanding the email before judging it
I examined the email headers, sender information, routing details, timestamps and metadata. These fields matter because the visible sender name is only one small part of an email. Header and routing information can help reconstruct how a message moved and whether the surrounding technical details are consistent with the story being presented.
This stage was about context. I wanted to know what the message could tell me before I moved on to the files attached to it.
Moving to the attachments
After extracting the associated attachments for examination, I calculated hashes including MD5/SHA-based values where used in the original case workflow. I then used those identifiers and the files themselves for additional checks.
VirusTotal was one source of threat intelligence, not the final answer. A reputation result can be useful, but it does not replace the rest of the investigation.
Sandbox review — and why I did not stop there
The attachments were also reviewed in an isolated/sandboxed environment. The point was to observe them without casually trusting or executing unknown material on a normal system.
The important lesson here was that one check does not answer every question. Even when an initial review does not immediately produce an obvious malicious indicator, that is not a reason to stop thinking.
Going deeper with steganographic examination
The investigation went further into steganographic examination. Hidden content was identified during the deeper review, which mattered because it showed why an apparently ordinary file can still deserve additional examination.
I am deliberately not reproducing sensitive case material here. What matters for this portfolio is the reasoning: the investigation continued because different techniques answer different questions.
Putting the evidence together
I did not treat the header analysis, metadata, hashes, VirusTotal results, sandbox observations and steganographic findings as separate mini-projects. The useful part was considering how they related to one another.
The question was: what does each piece of evidence tell me, and do the pieces support the same conclusion?
What I took from the case
One thing this case reinforced for me was that one tool rarely gives you the entire answer. A file can look ordinary during one check and still give you a reason to investigate further somewhere else.
The useful part is not running as many tools as possible. It is knowing what question each tool is helping you answer, documenting the result, and being careful not to claim more than the evidence supports.